Protected with encrypted sessions and CSRF validation